A terminated assessor clerk still shows as active staff on notables because the identity lookup last refreshed before HR finished offboarding. What SIEM problem is that?
Select an answer to reveal the explanation.
Short Explanation
Asset and Identity is the SOC's employee directory glued onto every notable. If HR already walked that clerk out and the lookup still says active staff, every alert about that account is telling the wrong story. Dirty identity data is an investigation-quality problem, not a cosmetic one.
Full Explanation
A terminated assessor clerk still showing as active staff on notables because the identity lookup last refreshed before HR finished offboarding is a stale Asset and Identity data problem. Stale identity records mis-prioritize and mis-attribute investigations: urgency, ownership, and watchlists may treat a departed clerk as a current insider, delaying the correct civic response and confusing managers.
Blaming a missing indexer-cluster peer that cannot resolve the clerk's hostname misplaces the issue in clustering rather than identity freshness and HR feed latency. Calling it an expected CIM limit that identity lookups are display-only and never affect notables is false—Asset and Identity enrichment directly influences notable urgency and attribution in Enterprise Security. Treating it as proof that correlation searches should ignore user and key only on src_ip abandons identity context defenders need for insider and account-abuse cases.
Exam caveat: offboarding gaps surface as stale Asset and Identity data; fix lookup refresh and HR feeds rather than disabling identity enrichment.
Operational check: force an identity lookup refresh from the HR source of truth, confirm the assessor clerk is disabled or removed, regenerate a test notable, and verify attribution no longer presents the user as active staff on Incident Review.